Splunk Search

Is it possible to use fillnull for fieldnames with a specific pattern?

Motivator

Hi,

is it possible to use fillnull for fields with a specific pattern? Wildcards are not working, but I want to avoid using fillnull for each and every field.

For example I would like to fillnull all fieldnames that contain "ABC".

Cheers
Heinz

0 Karma
1 Solution

Revered Legend

Try this workaround

...| foreach *ABC* [eval "<<FIELD>>"=coalesce('<<FIELD>>',"YourDefaultValueHere") ]

View solution in original post

Revered Legend

Try this workaround

...| foreach *ABC* [eval "<<FIELD>>"=coalesce('<<FIELD>>',"YourDefaultValueHere") ]

View solution in original post

Motivator

works fine, thanks a lot

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!